The report didn't identify the negligent executives, but it chastised the company's legal department for not looking more deeply into the 2014 breach. Because of that, the incident "was not properly investigated and analysed at the time," the report concluded.

Yahoo didn't disclose the 2014 breach until last September when it began notifying at least 500 million users that their email addresses, birth dates, answers to security questions, and other personal information may have been stolen. Three months later, Yahoo revealed it had uncovered a separate hack in 2013 affecting about 1 billion accounts, including some that were also hit in 2014.

More than 40 lawsuits also have been filed seeking damages for the breaches. If Yahoo's sale to Verizon is completed as expected later this year, a successor company called Altaba Inc. will be responsible for paying those legal claims.

Yahoo's handling and disclosure of the breaches is also under investigation by the Securities and Exchange Commission and the Federal Trade Commission.

In a blog post on Yahoo's Tumblr service , Ms Mayer said she didn't learn about the scope of the breaches until September and then tried to set things right. "However, I am the CEO of the company and since this incident happened during my tenure, I have agreed to forgo my annual bonus and my annual equity grant," she wrote.

In its report, Yahoo's board said it decided to withhold a cash bonus that otherwise would have been paid to her. Ms Mayer is eligible to receive a bonus of up to $2 million annually. The board said it accepted Ms Mayer's offer to relinquish her annual stock award, which is typically worth millions of dollars.

Ms Mayer said she wants the board to distribute her bonus to Yahoo's entire workforce of 8,500 employees. The board didn't say if it would do so.

Losing her bonus and annual stock award probably won't be too painful for Mayer, who is already rich after working for more than a decade as a top executive at Google and then as Yahoo's CEO for the past 4 1/2 years. She is also in line for a $44 million severance package if she doesn't go to work for Verizon after the sale closes.